← Back to search

@modelcontextprotocol/conformance

modelcontextprotocol Scanned 12d ago

A framework for testing MCP (Model Context Protocol) client and server implementations against the specification.

npm ↗
C
65 / 100

Versions

0.2.0-alpha.10latest
Jul 27, 2026
0.2.0-alpha.9
Jul 1, 2026
0.2.0-alpha.8
Jun 30, 2026
0.2.0-alpha.7
Jun 25, 2026
0.2.0-alpha.6
Jun 24, 2026
+ show 20 moreshow less
0.2.0-alpha.5
Jun 23, 2026
0.2.0-alpha.4
Jun 16, 2026
0.2.0-alpha.3
Jun 12, 2026
0.2.0-alpha.2
Jun 3, 2026
0.2.0-alpha.1
May 26, 2026
0.2.0-alpha.0
May 22, 2026
0.1.16
Mar 30, 2026
0.1.15
Feb 20, 2026
0.1.14
Feb 13, 2026
0.1.13
Feb 5, 2026
0.1.12
Jan 30, 2026
0.1.12-alpha.0
Jan 28, 2026
0.1.11
Jan 23, 2026
0.1.10
Jan 20, 2026
0.1.9
Jan 6, 2026
0.1.8
Dec 15, 2025
0.1.7
Nov 20, 2025
0.1.6
Nov 19, 2025
0.1.5
Nov 11, 2025
0.1.0
Nov 11, 2025
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 2

echo
annotations: none low

Echo the input back

stateless-dispatch
annotations: none low

Permissions 3

network medium
Server uses network capabilities via: fetch(), http
shell high
Server uses shell capabilities via: child_process, execSync(), spawn()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 50

low
Tool 'echo' has no annotations annotation_checker · 100%
low
Tool 'stateless-dispatch' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client secret in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/march-spec-backcompat.ts auth_checker · 95%
high
Hardcoded OAuth client ID in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/enterprise-managed-authorization.ts auth_checker · 85%
high
Hardcoded OAuth client secret in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/enterprise-managed-authorization.ts auth_checker · 95%
high
Hardcoded OAuth client ID in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/authorization-server-migration.ts auth_checker · 85%
high
Hardcoded OAuth client secret in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/authorization-server-migration.ts auth_checker · 95%
high
Hardcoded OAuth client secret in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/issuer-parameter.ts auth_checker · 95%
high
Hardcoded OAuth client ID in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/pre-registration.ts auth_checker · 85%
high
Hardcoded OAuth client secret in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/pre-registration.ts auth_checker · 95%
high
Hardcoded OAuth client ID in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/wif-jwt-bearer.ts auth_checker · 85%
high
Hardcoded OAuth client ID in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/client-credentials.ts auth_checker · 85%
high
Hardcoded OAuth client secret in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/client-credentials.ts auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-35p6-xmwp-9g52) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-4cwx-7wf7-3272) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-8xcm-r25x-g524) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-g8m3-5g58-fq7m) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-hm92-r4w5-c3mj) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-jr45-8vmc-qm54) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-m8rv-5g2x-5cg5) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-p88m-4jfj-68fv) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-pr7r-676h-xcf6) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-v3r7-h72x-cjcm) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-vmh5-mc38-953g) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-vxpw-j846-p89q) dependency_analyzer · 95%
medium
Vulnerable dependency: yaml@2.8.2 (GHSA-48c2-rrv3-qjmp) dependency_analyzer · 95%
medium
Buffer.from base64 in modelcontextprotocol-conformance-74edef3/src/scenarios/client/http-custom-headers.ts:86 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-conformance-74edef3/src/scenarios/client/http-custom-headers.ts:129 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/enterprise-managed-authorization.ts:340 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/authorization-server-migration.ts:195 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/pre-registration.ts:59 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/client-credentials.ts:318 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/token-endpoint-auth.ts:31 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: echo manifest_parser · 85%
info
Tool: stateless-dispatch manifest_parser · 75%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (5) manifest_parser · 80%
medium
Hardcoded OAuth client ID in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/enterprise-managed-authorization.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/authorization-server-migration.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/pre-registration.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/wif-jwt-bearer.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in modelcontextprotocol-conformance-74edef3/src/scenarios/client/auth/client-credentials.ts oauth_scope_analyzer · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 80%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 372 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%